EUVD-2026-38030Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan LAN for exposed grpc-device port
-
DeliveryOpen unauthenticated gRPC channel
-
ExploitInvoke driver RPCs without credentials
-
ExecutionRead or modify instrument state
-
ImpactManipulate test results or hardware output
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The grpc-device server must be started without TLS configuration AND bound to an interface beyond loopback (e.g., 0.0.0.0 or a specific LAN IP), which is a non-default but operationally common posture when remote test controllers need to reach instruments. Exploitation is further limited to attackers with routable network reachability to that interface - the CVE language is explicit about 'local network,' so internet exposure requires an additional misconfiguration (NAT/port-forward or public-IP binding). No user interaction, no credentials, and no specific client platform are required once those deployment conditions are met. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) realistically captures the worst case: an attacker with LAN reachability and no credentials can read and manipulate instrument state, but availability impact is rated N, consistent with a control-plane abuse rather than a crash. The 9.3 score is only reached when the operator both (a) omits TLS configuration and (b) binds beyond loopback - so real-world risk is highly bimodal: catastrophic on misconfigured lab/factory networks, near-zero on default loopback deployments. There is no CISA KEV entry and no public exploit identified at time of analysis, and no EPSS score was provided, so prioritization should be driven by deployment inventory rather than exploitation telemetry. The signals are internally consistent; the main uncertainty is what fraction of installs actually run with the vulnerable configuration, which the input data does not quantify. |
| Exploit ScenarioDerived | An attacker on the same factory-floor or lab network scans for the grpc-device port on hosts that have been bound to 0.0.0.0 without TLS, opens an unauthenticated gRPC channel, and issues driver calls to read live measurements or reconfigure instruments - for example altering DAQ output voltages or VISA session settings. No public exploit identified at time of analysis, but the CVSS 4.0 AV:N/AC:L/PR:N profile means a generic gRPC client plus the public .proto definitions from the ni/grpc-device repository is sufficient to interact with the service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 19, 2026
Unauthenticated network access to NI grpc-device 2.17.0 and earlier is possible when the server is deployed without TLS configuration and bound to a non-loopback interface, exposing instrument control services to anyone on the local network. The flaw stems from insecure default credentials behavior and aligns with CWE-306 (missing authentication for a critical function). No public exploit identified at time of analysis, though the CVSS 4.0 base score of 9.3 reflects high confidentiality and integrity impact under default-prone deployments.
Earlier versions of this analysis (2)
Authentication bypass in NI grpc-device 2.17.0 and prior allows unauthenticated remote attackers on the local network to access the gRPC server when TLS is not configured and the server is bound to a non-loopback interface. The flaw stems from insecure default credentials (CWE-306, Missing Authentication for Critical Function) and carries a CVSS 4.0 base score of 9.3 with high confidentiality and integrity impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated network access to NI grpc-device server is possible in versions 2.17.0 and earlier when the server is bound to a non-loopback interface without TLS configuration, due to insecure default credentials behavior. Any user on the same network can reach the gRPC service and operate connected instrumentation, with no public exploit identified at time of analysis. The flaw also touches NI InstrumentStudio deployments that embed the affected grpc-device server.
RemediationAI
Patch available per vendor advisory - consult the NI security bulletin at https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html and the GitHub Security Advisory GHSA-fhhw-37q8-6562 for the fixed grpc-device build; an exact fixed version was not provided in the input data, so verify the target release on the advisory before deploying. Until the patched build is rolled out, enable TLS plus client credential configuration on every grpc-device instance, or rebind the server to 127.0.0.1/loopback only, which eliminates remote exposure at the cost of preventing legitimate remote test clients from connecting. As a network-layer compensating control, place grpc-device hosts behind a host firewall or VLAN ACL that restricts the gRPC listening port to known test-controller IPs; this preserves remote functionality but adds operational overhead when test infrastructure changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NI grpc-device is National Instruments' gRPC-based server that exposes hardware instrument drivers (NI-DAQmx, NI-VISA, etc.) so remote clients - often InstrumentStudio or custom test executives - can control physical test and measurement hardware over the network. gRPC services typically rely on TLS plus token or mutual-cert authentication; this CVE reflects CWE-306 because when an operator binds the server to 0.0.0.0 or another routable interface without enabling the optional TLS/credential configuration, the service accepts unauthenticated RPCs by default. The vulnerability therefore lives in the deployment-time security posture of the server rather than a parser or memory bug, and it co-affects InstrumentStudio per the CPE list because that product consumes the same grpc-device backplane.
Know when Grpc Device gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable gRPC service with no auth when misconfigured gives AV:N/AC:L/PR:N/UI:N; instrument read/write yields C:H/I:H, but no availability impact is described so A:N.
Primary rating from Vendor (NI).
CVSS VectorVendor: NI
Lifecycle Timeline
1DescriptionCVE.org
There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback. This may allow an unauthenticated user access to the server on the local network. This affects NI grpc-device 2.17.0 and prior versions.
Executive ViewAI
NI grpc-device versions 2.17.0 and earlier expose unauthenticated, network-accessible instrument control services when deployed without TLS encryption on non-loopback interfaces, creating critical risk for any connected industrial or research environment. No public exploit has been identified at time of analysis, but the 9.3 CVSS score reflects severe potential for unauthorized device control and sensitive data exfiltration. Organizations must immediately isolate affected deployments pending patch availability.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce TLS/HTTPS encryption for all grpc-device server deployments; (2) Restrict binding to loopback interface (127.0.0.1) where remote access is not required; (3) Implement network firewalling to permit access only from trusted subnets; (4) Deploy VPN or jump-host access controls for legitimate remote connections; (5) Enable logging and monitoring for unauthorized connection attempts to instrument control services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Grpc Device
View allRemote code execution in NI grpc-device 2.17.0 and earlier is possible when an attacker sends a specially crafted Monike
Denial of service in NI grpc-device 2.17.0 and prior allows remote unauthenticated attackers to crash the data moniker s
Remote denial of service in NI grpc-device 2.17.0 and earlier allows unauthenticated network attackers to crash the stre
Denial of service in NI grpc-device 2.17.0 and earlier allows an authenticated remote attacker to crash or destabilize t
Silent integer truncation in NI grpc-device 2.17.0 and earlier allows unauthenticated network-accessible attackers to co
Memory exhaustion denial of service in NI grpc-device's BeginSidebandStream RPC endpoint allows authenticated network at
Exploit-DB